St. Cloud most recent in string of Florida cities hit with ransomware

Another city in Florida has announced a cyberattack, joining two others who have dealt with incidents over recent months. 

The city of St. Cloud said Monday it discovered a ransomware attack affecting city services and warned that while “many” city departments are affected they are “operating as best as possible until the issue is resolved.” St. Cloud is located about an hour south of Orlando and has 60,000 residents.

“In-person payments for Parks and Recreation events and services also are temporarily cash-only. Online facility reservation payments and online event registrations are still accepting credit card payments,” the statement said. 

“Police and Fire Rescue are responding to calls for service. Payment for services at the Transfer Station temporarily will be cash only, and all trash and recycling collection routes will operate as scheduled.”

The Osceola County Tax Collector's Office and external utility providers like Toho Water Authority and OUC were not affected by the attack.

Florida state officials are involved in the response to the incident but did not respond to a request for comment. No hacking group has taken credit for the incident. 

The attack on St. Cloud comes days after the city government of Pensacola similarly said it is dealing with widespread phone outages due to a cyberattack. Jacksonville Beach confirmed last week that it dealt with a ransomware attack in January.  

Ransomware expert Allan Liska said there were 256 publicly announced ransomware attacks against state and local governments in 2023, up from 196 attacks in 2022. 

“After a couple of years of these attacks slowing or even dropping they definitely seem to be on an uptick,” Liska said. 

“It is too early in the year to predict where things will end up for the full year. Right now, the number of attacks are trending downward with only 36 publicly reported. But, there is often a lag in attack reporting, so we expect the numbers to tick up.”

Like many large U.S. states, Florida’s institutions have faced a relentless barrage of attacks. The state’s Supreme Court, one of the biggest hospitals in the region, a sheriff's office and Florida International University have all been battered by ransomware gangs. This fall, a government water agency and a circuit court shut down following ransomware attacks. 

Florida is one of the few states in the U.S. to ban government entities from paying ransoms connected to cyberattacks. 

The 2022 law mandates that all Florida government agencies and departments report ransomware incidents within at least 12 hours and requires organizations to provide detailed information on the data stolen and ransom demanded. 

Near the end of the bill, the lawmakers said a “state agency… a county, or a municipality experiencing a ransomware incident may not pay or otherwise comply with a ransom demand.”